Update the to-do list for comments, and explain why we can't have a form for the...

[ikiwiki.git] / doc / tips / untrusted_git_push.mdwn

diff --git a/doc/tips/untrusted_git_push.mdwn b/doc/tips/untrusted_git_push.mdwn
index 48024566befcb62bb262f4fb2861de3b6e1e8d7c..aef67a3db7f048532b90e90ad9fe6d1f99b87fbf 100644 (file)
--- a/doc/tips/untrusted_git_push.mdwn
+++ b/doc/tips/untrusted_git_push.mdwn
@@ -21,12 +21,12 @@ repository's `pre-receive` hook. There it will examine every change that
 untrusted users push into the wiki, and reject pushes that contain changes
 that cannot be made using the web interface.
 
-So, unless you have the [[ikiwiki/plugin/attachment]] plugin turned on,
+So, unless you have the [[plugins/attachment]] plugin turned on,
 non-page files cannot be added. And if it's turned on, whatever
 `allowed_attachments` checks you have configured will also check files
 pushed into git.
 
-And, unless you have the [[ikiwiki/plugin/remove]] plugin turned on, no
+And, unless you have the [[plugins/remove]] plugin turned on, no
 files can be deleted.
 
 And if you have `locked_pages` configured, then it will also affect what's
@@ -39,12 +39,15 @@ or manipulate tags.
 One thing to keep an eye on is uploading large files. It may be easier to
 do this via git push than using the web, and that could be abused.
 
+Also, no checking is done that the authors of commits are right, so people
+can make a commit that pretends to be done by someone else.
+
 ## user setup
 
 Add a dedicated user who will push in untrusted commits. This user should have
 a locked password, and `git-shell` as its shell.
 
-       root@bluebird:/home/joey>adduser --shell=/usr/bin/git-shell--disabled-password anon
+       root@bluebird:/home/joey>adduser --shell=/usr/bin/git-shell --disabled-password anon
        Adding user `anon' ...
 
 ## ikiwiki setup